search_cves
Search the NVD for CVEs by keyword, severity, CPE, CWE, KEV status, or date range, and retrieve detailed vulnerability data including CVSS scores and references.
Instructions
Search the National Vulnerability Database (NVD) for CVEs matching the given filters.
Returns a JSON string with pagination info and a list of matching CVEs, each containing: id, published date, status, English description, CVSS score, CWE weaknesses, top 5 references, and CISA KEV data if applicable.
Performance guidance:
Keep results_per_page at 5–10 to avoid slow responses.
When filtering by date, limit the window to 30 days or less.
Broad severity or keyword queries without a date range can be slow; add pub_start_date / pub_end_date or last_mod_start_date / last_mod_end_date to speed them up.
Mutually exclusive groups (enforced by validation):
cvssV2Metrics / cvssV3Metrics / cvssV4Metrics: use at most one
cvssV2Severity / cvssV3Severity / cvssV4Severity: use at most one
isVulnerable requires cpeName and excludes virtualMatchString
version range params (versionStart/End) require virtualMatchString
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| request | Yes | Pydantic model for request params validation. Please note, as of July 2022, the NVD no longer generates new information for CVSS v2. Existing CVSS v2 information will remain in the database but the NVD will no longer actively populate CVSS v2 for new CVEs. NVD analysts will continue to use the reference information provided with the CVE and any publicly available information at the time of analysis to associate Reference Tags, information related to CVSS v3.1, CWE, and CPE Applicability statements. The CVE API returns four primary objects in the response body that are used for pagination: resultsPerPage, startIndex, totalResults, and vulnerabilities. totalResults indicates the total number of CVE records that match the request parameters. If the value of totalResults is greater than the value of resultsPerPage, there are more records than could be returned by a single API response and additional requests must update the startIndex to get the remaining records. The best, most efficient, practice for keeping up to date with the NVD is to use the date range parameters to request only the CVEs that have been modified since your last request. If filtering by `isVulnerable`, `cpeName` is required. Please note, `virtualMatchString` is not accepted in requests that use `isVulnerable`. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |